Reflected Cross-Site Scripting in Dictionary Plugin for WordPress
CVE-2025-15697

Currently unrated

Key Information:

Vendor

WordPress
Status
Dictionary
Vendor
CVE Published:
17 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-15697?

The Dictionary plugin for WordPress, in versions up to 1.0, fails to properly escape user input before reflecting it in responses from multiple accessible scripts. This gap allows unauthorized attackers to exploit the vulnerability and launch reflected cross-site scripting (XSS) attacks. By submitting specially crafted requests, an attacker can manipulate the responses to execute malicious scripts in the browsers of users who are tricked into submitting these requests, establishing a potential avenue for session hijacking and other attacks.

Affected Version(s)

Dictionary 0 <= 1.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-15697 - Proof of Concept

References

https://wpscan.com/vulnerability/b0d12b0d-4717-4854-8911-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hassan Khan Yusufzai - Splint3r7
WPScan
.